[PATCH] rionet: Fix refcounting bugs

[Liang He <windhl@126.com>]

In rionet_start_xmit(), we should put the refcount_inc()
before we add *skb* into the queue, otherwise it may cause
the consumer to prematurely call refcount_dec().
Besides, before the next rionet_queue_tx_msg() when we
meet the 'RIONET_MAC_MATCH', we should also call
refcount_inc() before the skb is added into the queue.

Fixes: 7c4a6106d645 ("rapidio/rionet: fix multicast packet transmit logic")
Signed-off-by: Liang He <windhl@126.com>
---
 drivers/net/rionet.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index fbcb9d05da64..72ccbb1aaf11 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -195,17 +195,19 @@ static netdev_tx_t rionet_start_xmit(struct sk_buff *skb,
 		for (i = 0; i < RIO_MAX_ROUTE_ENTRIES(rnet->mport->sys_size);
 				i++)
 			if (nets[rnet->mport->id].active[i]) {
-				rionet_queue_tx_msg(skb, ndev,
-					nets[rnet->mport->id].active[i]);
 				if (count)
 					refcount_inc(&skb->users);
 				count++;
+				rionet_queue_tx_msg(skb, ndev,
+					nets[rnet->mport->id].active[i]);
 			}
 	} else if (RIONET_MAC_MATCH(eth->h_dest)) {
 		destid = RIONET_GET_DESTID(eth->h_dest);
-		if (nets[rnet->mport->id].active[destid])
+		if (nets[rnet->mport->id].active[destid]) {
+			refcount_inc(&skb->users);
 			rionet_queue_tx_msg(skb, ndev,
 					nets[rnet->mport->id].active[destid]);
+		}
 		else {
 			/*
 			 * If the target device was removed from the list of
-- 
2.25.1